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ABSTRACT 

The Space Shuttle navigation architecture was originally 
designed in the 1970s. A variety of on-board and ground 
based navigation sensors and computers are used during 
the ascent, orbit coast, rendezvous, (including proximity 
operations and docking) and entry flight phases. With the 
advent of GPS navigation and tightly coupled GPS/INS 
units employing strapdown sensors, opportunities to 
improve and streamline the Shuttle navigation process are 
being pursued. These improvements can potentially 
result in increased safety, reliability, and cost savings in 
maintenance through the replacement of older 
technologies and elimination of ground support systems 
(such as Tactical Air Control and Navigation (TACAN), 
Microwave Landing System (MLS) and ground radar). 
Selection and missionization of “off the shelf’ GPS and 
GPS/INS units pose a unique challenge since the units in 
question were not originally designed for the Space 
Shuttle application. Various options for integrating GPS 
and GPS/INS units with the existing orbiter avionics 
system were considered in light of budget constraints, 
software quality concerns, and schedule limitations. An 
overview of Shuttle navigation methodology from 1981 


to the present is given, along with how GPS and GPS/INS 
technology will change, or not change, the way Space 
Shuttle navigation is performed in the 21 st century. 


INTRODUCTION 

In the 1970s, the Space Shuttle was designed with three 
TACAN units for use during the entry phase of flight. By 
the late 1970s, with the NAVSTAR GPS program 
promising a revolution in navigation, the use of GPS on 
the Shuttle orbiters was studied [1]. The orbiters 
Discovery, Atlantis and Endeavour were all manufactured 
in the 1980s with GPS antennae and associated wiring. 
However, due to budget concerns and the developmental 
nature of GPS, a GPS upgrade to the Shuttle system was 
not pursued. 

In 1990, the introduction of GPS had led the Department 
of Defense and the Federal Aviation Administration to 
plan the phase out of TACAN ground stations beginning 
in the year 2000. GPS promised better performance than 
TACAN and reduced operating costs. In response, then 
Shuttle program Manager (and former astronaut) Robert 
Crippen initiated an effort to study the possibility of 
replacing the three TACAN units on each orbiter with 
three GPS receivers. 

By 1996, the development of Embedded GPS/INS (or 
EGI) units employing strapdown inertial sensors [2] 
motivated the Shuttle program to look at an eventual 
replacement of the previously mentioned stand alone GPS 
(the TACAN replacement) and stable member, spinning 
mass gyro Kearfott High Accuracy Inertial Navigation 
Systems (HAINS) Inertial Measurement Units (IMUs) 
with EGIs. The use of strapdown IMUs employing ring 
laser gyro (RLG) technology was identified as a potential 
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source of cost and schedule savings during orbiter 
processing. 

Both the TACAN replacement and GPS/IMU replacement 
efforts were conducted in parallel. Studies were 
performed to determine the best integration architecture. 
Stand alone GPS units and EG Is had to be integrated in a 
manner that did not compromise the integrity of an 
operational, certified navigation system. Once it was 
decided to tailor the GPS receiver requirements to 
TACAN replacement, studies were conducted to 
determine if there were other applications for GPS during 
Shuttle flights. 

Changes to the Shuttle General Purpose Computers 
(GPCs) to support both projects were identified. GPS and 
EG I hardware was selected; interface, firmware and 
hardware changes were identified and made. Both the 
GPS and EGI units were flown on a series of Shuttle 
missions for test and_evaIuation. Modifications were 
made to GPS and EGI firmware based on flight test 
results. 


OVERVIEW OF SPACE SHUTTLE NAVIGATION 
SYSTEM 

Navigation requirements for manned spacecraft are 
different than those for terrestrial aircraft, unmanned 
Earth orbiting satellites and interplanetary probes [3, 4]. 
The guidance, navigation and flight control system had to 
be designed to ensure safety of flight and mission success 
for ascent, orbit, rendezvous and gliding entry to a 
runway landing in the presence of system failures. For 
ascent and entry, a total of five computers, running in 
parallel, can control the vehicle. Four of the GPCs run 
what is known as the Primary Flight Software Sub- 
System (PASS) software. The fifth runs Backup Flight 
Software (BFS). PASS and BFS software was coded by 
different contractors. The BFS contains a subset of the 
PASS functionality to enable the vehicle to finish nominal 
ascent, an abort or landing in the event of a generic PASS 
software failure. While on orbit, only PASS software 
provides guidance, navigation and flight control 
functions. Multiple navigation sensors, command paths 
and power buses within the avionics system ensure 
redundancy [5, 6]. 

Navigation sensors used in the “pre GPS era” include: 
Ascent 

• Three HAINS IMUs 

• Ground based C & S Band radar tracking. 


Or bit . Re n dezvous & Dockin g 

• Three HAINS IMUs 

• Two Star Trackers 

• One Ku Band Rendezvous Radar 

• One Crew Optical Alignment Sight (COAS) 

• T rajectory Control Sensor (TCS, a laser) 

• Two Hand Held Lasers (HHL) 

• Two Payload Bay Television Cameras With 
Ranging Ruler Overlays 

• Ground based C Band radar tracking. 

• Tracking And Data Relay Satellite (TDRS) S 
Band Doppler tracking. 

Entry And Landing 

• Three HAINS IMUs 

• Three TACANs 

• Four Barometric Altimeters 

• Three Ku Band MLS Receivers 

• Two Radar Altimeters 

• Ground based C & S Band radar tracking. 

• At least two TACAN ground stations. 

• MLS ground equipment. 

For HAINS IMUs, TACANs, barometric altimeters and 
MLS units, redundant measurements are passed through 
Fault Detection, Identification and Reconfiguration 
(FDIR) algorithms [7]. Selection filters then process data 
from units deemed to be “good.” Selected measurements 
are then passed to the Shuttle navigation software. 

HAINS IMU data is used during all flight phases for 
attitude and sensed velocity determination. During entry, 
PASS and BFS Kalman filters process selected TACAN, 
IMU derived altitude and barometric altimeter 
measurements. Only the PASS Kalman filter processes 
selected MLS data. Selected radar altimeter data is 
provided for crew situational awareness, but is not 
incorporated into the navigation solution. 

During rendezvous, a PASS Kalman filter processes on- 
board radar, star tracker and COAS measurements. TCS 
and HHL data are processed in Kalman filters residing in 
a laptop computer for crew situational awareness. 
Television monitors with ranging ruler overlays provide 
range information to the crew during docking. 

INTEGRATING GPS IN A LOOSELY COUPLED 
ARCHITECTURE 

A loosely coupled architecture using cascaded filters is a 
common way of upgrading existing navigation systems 
with GPS. This method of integration has been used on 
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platforms such as the F-16 [8), F-l 17 [9], Conventional 
Air Launched Cruise Missile [10] and B-2 [11]. 

A cascaded filter approach involves using the position 
output of the GPS receiver as a measurement for a 
Kalman filter in the host vehicle navigation system [8]. 
Position and velocity aiding data from the host vehicle 
INS are fed back to the GPS receiver to improve signal 
acquisition and tracking performance. However, the 
Kalman filter is derived under the assumption that 
measurements are not time correlated. This assumption is 
violated by processing the GPS position vector in the host 
vehicle Kalman filter. Time correlated measurements can 
lead to filter instability. This problem has been avoided 
in many applications by processing GPS position vectors 
at a low rate, such as no higher than every 15 seconds 
[ 10 ]. 

One option considered was to process GPS position 
vectors as measurements in the PASS and BFS Kalman 
filters, as is done in many military applications. 

Another option studied was to convert GPS position into 
a TACAN measurement (known as “TACAN 
transparency”). This was an attempt to minimize or avoid 
changes to the PASS and BFS flight software and 
input/output. This would have resulted in a high rate 
cascaded filter implementation (TACAN measurements 
are processed every 3.84 seconds). A “transparent” 
approach would not have allowed INS aiding to be 
supplied to the receiver from the GPC. Crew displays 
required GPS receiver specific controls and quality 
assessments, and GPS data needed to be sent to Mission 
Control for the flight controllers. For on-orbit processing, 
a new Kalman filter would have to be created. On-orbit 
processing of “pseudo TACAN” measurements could 
only have been performed within the line-of-sight of the 
TACAN stations already in the flight software to support 
landing. 

Neither of the loosely coupled, cascaded filter options 
were acceptable to the Shuttle program. Processing GPS 
as a TACAN measurement or filtering the GPS position 
vector could not have been evaluated in flight without 
actually incorporating the data into the navigation state. 
Both of these options would have required retuning the 
entry navigation Kalman filters in the PASS and BFS 
flight software. A new PASS flight software Kalman 
filter for the orbital phase of flight would have to be 
created. Any modifications to the existing filters for 
entry, or a new Kalman filter for orbit, would result in an 
extensive flight software development and certification 
effort. 


THE TIGHTLY COUPLED OPTION 

In a tightly coupled integration, processing actual GPS 
measurements (pseudorange, delta range) from a GPS 
receiver in a host vehicle computer permits the navigation 
system designer to have more control over the quality of 
the navigation solution, rather than having to rely on a 
receiver vendor’s proprietary firmware. Processing high 
rate, unfiltered GPS observables and inertial measurement 
unit data in a central Kalman filter permits higher 
accuracy navigation and less vulnerability to GPS outages 
and jamming. This architecture enables rapid estimation 
of GPS receiver clock errors and inertial measurement 
unit errors [8]. 

Processing of GPS pseudoranges in the PASS and BFS 
flight software was also considered, but not chosen. Like 
the cascaded filter options discussed previously, it would 
have required modifications to baseline entry navigation 
and a new Kalman filter for the on-orbit phase. 
Furthermore, there were security concerns with sending 
“corrected” pseudoranges outside the keyed GPS receiver 
to the Shuttle GPCs. Uncorrected pseudoranges could be 
processed in the GPCs, but the entry and new orbit 
Kalman filters would have to solve for the corruption due 
to Selective Availability. 

STATE REPLACEMENT CHOSEN 

After considering eight integration options, the Shuttle 
program directed that GPS be integrated “in parallel” with 
the existing “baseline” navigation on the orbiters. A GPS 
state (position and velocity) selected by the Shuttle flight 
software would “overwrite” the Shuttle flight software 
navigation state. “State replacement” in the Shuttle 
navigation software was chosen over treating GPS as a 
sensor and filtering the GPS measurements or state 
vector. This architecture treats the GPS receiver as a 
complete navigation system [12]. Any potential problems 
with cascaded Kalman filters would be avoided. State 
replacement could be implemented so that the same GPC 
flight software could be used for GPS processing during 
both orbit and entry. 

Another advantage of state replacement is that it permits 
flying the GPS receiver in a test mode during flights, 
without having to use GPS for navigation. This allows 
operation of a “mixed fleet” of GPS and TACAN 
hardware configurations with the same version of PASS 
and BFS flight software. Due to the schedule of orbiter 
overhaul periods, not all orbiters would be equipped with 
GPS units at the same time. Supported TACAN/GPS 
configurations are: 


• Three TACANs for operational use and one GPS 
receiver for data gathering. 

• Three GPS units for operational use and no 
TACANs. 

• Three TACANs and no GPS onboard. 

It was believed that this approach would also make it 
easier to upgrade the Shuttle with more advanced 
receivers, whereas the Kalman filtering of GPS 
measurements or vectors in the Shuttle GPCs might 
require retuning the filters in the GPC. Furthermore, if a 
receiver upgrade occurred, it was believed that this 
approach would eliminate the need for detailed 
knowledge of the GPS receiver’s firmware. 

The GPS receivers are provided with position, velocity 
and attitude aiding from the Shuttle flight software 
(PASS, or BFS in the event of a PASS software failure). 
One aiding state vector is propagated for all three 
receivers, using selected IMU data from candidates that 
have been screened by a FDIR algorithm. The single 
aiding state is periodically reset with the Shuttle 
navigation state. 

The PASS flight software subjects GPS state vectors to 
three Quality Assurance (QA) checks. The QA tests were 
designed so that retuning of the receiver Kalman filter, or 
changes to receiver residual edit tests would not be 
necessary for the Shuttle missionization. 

• A check of several receiver parameters, one of 
which is the Figure of Merit (FOM). 

• The current GPS state is compared with the 
receiver’s previous state propagated to the 
current time. 

• Comparison of the receiver states with each 
other. 

If criteria for any of the QA tests are violated, that 
receiver’s state is not a candidate for selection. State 
vectors from candidate GPS units are then processed in a 
selection filter. The BFS flight software uses a simpler 
QA and selection scheme than PASS. There are crew 
controls that allow these QA tests to be bypassed, if 
necessary. 

Once the QA checks are complete and a GPS state has 
been selected, there are two crew commanded methods 
for incorporating the selected GPS state into navigation. 
The first involves automatic incorporation at a flight 
phase dependent rate, if the selected GPS state is within a 
tolerance of the current navigation state. The second 
method, called a “force,” Ignores the comparison test with 


the current navigation state and incorporates (forces) the 
selected GPS state into navigation. 


RECEIVER SELECTION 

For TACAN replacement, the Shuttle program desired an 
off the shelf, in production military unit designed for 
aircraft to take advantage of the existing production line 
and logistics base. The Shuttle program also desired to be 
an authorized user of GPS, to take advantage of the 
jamming and spoofing resistance provided by military 
GPS units. In addition, the Shuttle program wanted to 
benefit from firmware that had been “matured” through 
development and use by the Department of Defense. The 
Collins Miniaturized Airborne GPS Receiver (MAGR), a 
5 channel unit, was selected. 

Unlike earlier GPS receivers, the MAGR used digital, 
rather than analog tracking loops. This permitted space 
missionization to be performed via firmware, rather than 
hardware changes. Existing “space rated” GPS receivers 
were not suitable for the Shuttle (i.e. didn’t accept inertial 
aiding, too big and heavy for the Shuttle, not capable of 
“authorized” operation). At the time, there was not a 
military aircraft, all-in-view receiver in production. 


INITIAL FLIGHT TESTS AND RECEIVER 
MISSIONIZATION 

The first flight of a GPS receiver on the Shuttle was on 
mission STS-51 in September of 1993 [13]. A Trimble 
TANS Quadrex was flown. This experiment was not a 
part of the TACAN replacement project. The Quadrex 
was mounted in an overhead window on the flight deck. 
Signal attenuation from the glass and limited field of view 
severely impacted receiver performance. 

The initial flight test program supporting TACAN 
replacement involved the 5 channel, Collins 3M receiver. 
The 3M was a pre-production version of the Collins 
MAGR. This series of flight tests was intended to prove 
if a GPS receiver designed for terrestrial aircraft use could 
function on the Space Shuttle with a minimum number of 
firmware changes. 

INS aiding was supplied to the 3M by the BFS GPC 
during ascent and entry, while on-orbit the receiver was 
unaided and operated by a laptop computer. Receiver 
state vectors and other 3M data were recorded on the 
laptop. The 3M was not keyed. Since the purpose of the 
3M flight tests was purely data gathering, no navigation 
data was sent from the 3M receiver to the BFS GPC. The 
Collins 3M unit flew seven times (December, 1993 to 
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May, 1 996) on Endeavor (flights 6 1 , 59, 68, 67, 69, 72 
and 77). Modifications were made to the 3M firmware 
between flights based on flight test results. 

Hardware and firmware missionization of the Collins 
production MAGR forTACAN replacement began in 
1995. The version of the MAGR flown on the shuttle is 
known as the MAGR/S (MAGR/Shuttle). Collins based 
MAGR/S firmware on military MAGR Link 008, with 
Link 009 and 010 modifications also included. Lessons 
learned from the 3M flights were also incorporated into 
the MAGR/S firmware. 


“SINGLE STRING” TACAN REPLACEMENT 
FLIGHT TESTS 

A single MAGR/S unit (the “single string” configuration) 
is being flown t>n each orbiter for several years during a 
test and certificatiomprogram. The single string MAGR/S 
flown during the test phase has two antennas, one on the 
top and one on the bottom of the crew compartment (GPS 
2 in Figure 1). Input from the antennas are passed 
through pre-amplifiers and a signal combiner before 
reaching the MAGR/S. On many flights, a laptop 
computer is used to record instrumentation port data. 

This data proved to be invaluable in resolving MAGR/S 
performance issues. 


^ GPS 2 



The first flight of the single string MAGR/S configuration 
was on STS-79 in September of 1996. MAGR/S data was 
available in “real time” to Mission Control personnel 
during ascent and entry. More flights followed as each 
orbiter in the fleet was equipped with a single MAGR/S 
receiver. STS-91 in June of 1998 was the first flight 
during which GPS data was available “in real time” to 
Mission Control personnel during the orbital phase of 
flight. 

Detailed Test Objectives (DTOs) are being carried out 
during the single string flights. These tests involve 
astronaut execution of MAGR/S procedures. Selected 
MAGR/S state vectors were incorporated into the PASS 


and BPS flight software on several occasions while on 
orbit. On STS- 103 (December 1999, before the 
deactivation of Selective Availability), the MAGR/S was 
intentionally unkeyed prior to entry. The Shuttle will be 
certified to land with the MAGR/S unkeyed. Another 
DTO involved a “late power-on” of the MAGR/S just 
prior to entry on STS-92 (October 2000). This tested the 
ability of the MAGR/S to collect ephemerides, download 
the daily key and establish four satellite navigation during 
entry. 

For most of ascent, the Shuttle is in a “heads down” 
configuration. The GPS antenna on top of the crew 
compartment is facing the Earth, while the antenna below 
the crew compartment is facing the External Tank. In 
spite of the poor antenna visibility, enough GPS signals 
“wrap around” the External Tank and orbiter to permit the 
MAGR/S to track three to four satellites most of the time. 
However, the Geometric Dilution Of Precision (GDOP) is 
high, which can result in large state errors. On most 
flights, a roll to a heads up attitude is performed at about 
6 minutes into the flight. This provides excellent GPS 
satellite visibility to the antenna on top of the crew 
compartment. Receiver tracking and performance during 
this phase of ascent is usually exceptional. 

Periods of noisy GPS velocity were observed during the 
orbital phase of flight. Velocity noise was as high as 1 1 
feet/second. Noise periods lasted anywhere from 5 to 20 
minutes. Analysis indicated that the MAGR/S was 
processing noisy delta range measurements due to 
ionospheric scintillation [14]. This does not pose a 
constraint to certification of GPS as a TACAN 
replacement. 

Of particular interest is MAGR/S performance during the 
“plasma” region of re-entry. The term “blackout” is not 
used, since communication via the TDRS satellites can 
permit near continuous communication with the orbiter 
during entry, depending on the orbiter ground track and 
TDRS satellite visibility. 

Flight tests demonstrated that the MAGR/S does not 
experience a complete “blackout” of GPS signals during 
entry. Plasma effects begin to degrade lower antenna 
tracking of GPS satellites as high as 320,000 feet. Upper 
antenna tracking begins to degrade about the time of the 
first roll maneuver (typically around 285,000 feet). In 
spite of the plasma, the MAGR/S still tracks 1 to 4 
satellites during the plasma region. Frequent loss of lock 
occurs, along with a loss of carrier frequency tracking. 
Code tracking is maintained. 

Upper antenna plasma effects begin to subside around 
217,000 feet, and continuous carrier frequency tracking 
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on 4 satellites resumes by 200,000 feet on most missions. 
Lower antenna tracking can be degraded by plasma until 
around 1 85,000 feet. 

The impacts of the plasma region on the MAGR/S are 
extended periods of less than four satellite tracking, failed 
reacquisition attempts, incomplete data collection (i.e. 
ephemerides) and loss of delta range measurements. Less 
than optimum number of measurements and poor satellite 
geometry could result in an increasingly inaccurate GPS 
state vector. However, navigation errors during the 
plasma region has so far not been excessive. The orbiter 
can fly through this region without an update from GPS. 

Flight data from the MAGR/S as well as the GPC QA 
checks are examined both during and after missions. 

Flight tests and simulation results have driven changes to 
the MAGR/S firmware and PASS and BFS flight software 
that processes -MAGR/S data. 

Flight experience also drove a change to the position and 
velocity vector aiding scheme used by the PASS flight 
software. The original design involved propagation of a 
separate aiding state for each receiver, with each 
propagator having an independent source of IMU data 
(i.e. an IMU is assigned to each receiver). Instead, one 
aiding state vector is propagated for all three receivers, 
using selected IMU data from candidates that have been 
screened by a FDIR algorithm. Instead of periodically 
resetting the aiding states with each receiver’s own GPS 
state, the single aiding state is periodically reset with the 
Shuttle navigation state. The original design did not 
perform a “sanity check” on the GPS states used to reset 
the aiding states in the PASS flight software. Resetting 
the single aiding state with the Shuttle navigation state 
takes advantage of protection provided by the GPS QA 
checks, the GPS state selection process and the 
comparison of the selected GPS state with the current 
navigation state before GPS incorporation. The new 
aiding scheme also permits the ground to have more 
insight into and control over the position and velocity 
aiding states sent to the receivers. 

Once the MAGR/S units and Shuttle flight software for 
GPS are certified (anticipated to occur in the spring of 
2002), the three TACAN units on each orbiter will be 
removed and two MAGR/S receivers will be added to 
each orbiter, for a total of three MAGR/S units per 
orbiter. TACAN replacement will occur as each orbiter is 
cycled through a regularly scheduled overhaul. Antennas 
for the two additional MAGR/S units are on the top and 
bottom (Figure 1) of the nose in places formerly occupied 
by TACAN antennas. The first “three string GPS flight” 
(no TACAN) is expected to occur no earlier than 2003. 


MISSION CONTROL AND ON-BOARD, 
OPERATIONAL USE OF GPS 

The following sections give an overview of the current 
Shuttle navigation methodology. How GPS states will be 
used by the orbiter navigation system and Mission 
Control after MAGR/S certification is covered. Range 
safety is outside the scope of this paper. 

PRE GPS GROUND TRACKING 

Initially, the Shuttle program required continuous 
tracking from 2 radars during ascent and entry, so that 
Mission Control could determine the Shuttle state 
independently of the on-board navigation system. As 
confidence was established in the on-board system, the 
ascent/entry ground tracking requirement was changed 
from mandatory to highly desirable. 

Prior to launch, if there are certain failures on the vehicle, 
radar tracking to support navigation is required to meet 
Launch Constraint Criteria. C Band (range and angles) 
and S Band (range, Doppler, angles) radar data is 
processed in a Mission Control based Kalman filter. The 
filter can process data from one S Band and two C Band 
radars. 

If the Shuttle is to rendezvous with a spacecraft already in 
orbit (a “ground up rendezvous,” such as with the 
International Space Station (ISS) or Hubble Space 
Telescope), Mission Control checks the cross track 
velocity error after Main Engine Cut Off. A state vector 
update may be required prior to the OMS-2 maneuver for 
cross-track velocity error greater than 6 feet/second. The 
uplink would be based on ascent ground tracking data 
processing. 

Initially, S Band communication sites provided tracking 
(range, Doppler, angles) during the orbital phase of flight, 
when the orbiter was visible. As TDRS satellites were 
launched, ground S Band use for orbit was reduced. 

TDRS provides near global communications coverage, 
but only Doppler measurements due to the type of S Band 
transponder on the orbiter. 

On-orbit, both S Band TDRS Doppler measurements; and 
C Band radar data (range and angles from a number of 
tracking stations) are processed to estimate the orbiter’s 
state vector. The on-board navigation state is usually 
allowed to grow in down-track position error before a 
new state, based on radar and TDRS tracking, is uplinked. 
For landing, the maximum allowable downtrack position 
error at Entry Interface (400,000 feet) is 20 nautical 
miles. 


6 


TDRS S Band Doppler tracking provides a good estimate 
of the orbital semi-major axis (which reflects both 
position and velocity). C Band tracking resolves planar 
errors. Radar geometry plays a large role in determining 
the accuracy of ground-based navigation. On orbit, a 
weighted least squares algorithm is used by Mission 
Control for orbit determination. 

Ground-up rendezvous flights require radar tracking of 
the target spacecraft. Radar tracking begins from 18 to 24 
hours prior to Shuttle launch. Ground tracking of the 
target spacecraft continues through docking (ISS) or 
grapple (Hubble Space Telescope). If the orbiter deploys 
a scientific payload that is to be retrieved later in the 
mission, ground tracking of the deployed spacecraft will 
be performed to facilitate the rendezvous and grapple. 

For entry and landing, radar data is processed by Mission 
Control in the previously mentioned Kalman filter for 
independent assessment of onboard navigation systems. 
Since Shuttle landings are planned for the Kennedy Space 
Center (KSC), and radars are located there to support the 
Eastern Test Range, C Band and S Band radar tracking is 
usually available. C Band tracking is also usually 
available for landings at Edwards Air Force Base, since 
NASA has radars at the Dryden facility. However, range 
scheduling can prevent entry tracking. If there are certain 
failures in the on-board or ground navigation systems, 
radar tracking during entry becomes mandatory. 

During entry, radar normally becomes available in time 
for Mission Control to assess the TACAN units and 
navigation state health prior to TACAN processing in the 
GPCs. Mission Control can also perform an emergency 
state uplink to the orbiter if navigation errors are 
excessive. 


POST GPS 

Once GPS is certified, the Shuttle program will still 
consider radar tracking during ascent to be desirable, but 
not required, unless there are navigation equipment 
failures on the vehicle. 

Radar and TDRS tracking will still be used during the 
orbital phase to support maneuver planning in Mission 
Control. The MAGR/S Kalman filter has not been tuned 
for orbital dynamics, since emphasis was on a TACAN 
replacement and a Commercial Off The Shelf (COTS) 
approach that minimized MAGR/S modifications. 

The MAGR Kalman filter and navigation algorithms were 
designed so that the unit could be integrated into a wide 
variety of platforms, without having to substantially 


modify the Kalman filter for each application [ 1 5]. Filter 
tuning assumes a worst case inertial measurement unit 
and receiver clock. The downside to this approach is that 
the receiver is not optimized for space navigation. It 
effectively provides a blended deterministic solution 
without accurate gravity or drag modeling needed for 
accurate orbit determination. As a result, MAGR/S 
velocity errors, and the resulting semi-major axis errors, 
are not acceptable for orbit maneuver planning and 
rendezvous. Poor orbital navigation performance of GPS 
receivers originally designed for terrestrial use and the 
importance of semi-major axis accuracy is covered by 
Carpenter and Schiesser [16]. 

A GPS Ground Filter, for use in Mission Control, has 
been developed by United Space Alliance to support 
Shuttle and ISS maneuver planning and collision 
avoidance with space debris. The accuracy specifications 
for the ISS GPS receiver were designed to support 
antenna pointing. Like the MAGR/S, the ISS receiver has 
not been modified for space dynamics, and is not accurate 
enough to support maneuver planning. Once certified, 
the GPS Ground Filter will filter GPS position and 
velocity to provide Mission Control with more accurate 
GPS derived state vectors for the Shuttle and ISS. 

Near continuous availability of ground filtered GPS 
state vectors, in conjunction with radar and TDRS 
tracking, will allow more responsive mission planning. 
Burns will be confirmed more rapidly than with radar and 
TDRS data alone. If the orbiter is subjected to 
perturbations that are not modeled by Mission Control, it 
can take 2 or 3 revolutions before enough ground tracking 
data is available to quantify the impact on the orbiter 
state. The GPS ground filter will permit much more rapid 
perturbation determination. 

Once GPS is certified for operational use, ground radar 
tracking will be used on the initial u no TACAN” flights 
as a backup to GPS. After experience is gained with the 
certified GPS system on the Shuttle, it is expected that 
ground radar tracking activities will be reduced. TDRS is 
also used for telemetry and communications, thus the 
Doppler measurements will always be available for 
processing. However, radar and TDRS will still be 
designated as backups to GPS, and Mission Control 
Center personnel will maintain proficiency in C Band and 
S Band measurement processing. 

ASCENT AND POST INSERTION 

Navigation aids (TACANs, barometric altimeters, MLSs, 
radar altimeters) that would be used for an emergency 
landing due to an ascent abort are powered on and self 
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tests are run prior to the clay of launch. The three MAINS 
IMUs are calibrated and aligned prior to liftoff. Only 
1 1AINS IMU data (accumulated sensed velocity, gimbal 
angles) are processed by PASS and BFS navigation 
during powered flight [17]. No sensor measurements are 
processed by a Kalman filter. 


ASCENT AND POST INSERTION IN THE GPS ERA 

There is no change to the Shuttle baseline navigation (use 
of HA1NS IMU data) for powered flight. The MAGR/S 
units will be turned on approximately 5 hours prior to 
liftoff. This permits receivers to collect ephemerides of 
satellites that will be over the Trans Atlantic Landing 
(TAL) sites at launch. GPS states are not used by the 
Shuttle navigation software during powered flight, but 
receiver aiding data is supplied to the MAGR/S units by 
the GPCs. - 

After the MAGR/S and the GPS Ground Filter are 
certified, the GPS Ground Filter could be used as a source 
of post Main Engine Cut Off state vector uplinks. GPS 
vectors from the on-board MAGR/S units would not be 
incorporated directly into navigation. 


PRE GPS ORBIT COAST NAVIGATION 

During the orbit phase, the on-board navigation state is 
monitored and maintained by Mission Control via state 
vector uplinks. A vent force may also be uplinked by 
Mission Control for use by the GPCs. This takes into 
account non-propulsive forces acting on the orbiter that 
cannot be detected by the HAINS IMUs, and reduces 
error growth in the on-board state. Vent values are based 
on flight history for specific orbiter attitudes. The orbiter 
state (and for a rendezvous, the target spacecraft state) 
determined from C Band and S Band tracking are used by 
Mission Control for maneuver planning. 

Alignment of the HAINS IMUs is periodically performed 
using star sightings [ 1 8]. Two star trackers with near 
orthogonal lines of sight are located on the nose of the 
orbiters. Data from star sightings can also be used by 
Mission Control to determine IMU gyro biases. The 
ground determined biases are then uplinked for use in the 
Shuttle PASS flight software. If the orbiter cannot 
maneuver to a star sighting attitude due to excessive IMU 
misalignment, a rough alignment can be executed by a 
crew member sighting on a star using the Heads Up 
Display (HUD) or the COAS. This would be followed by 
a precise star alignment using the star trackers. 


ORBIT COAST NAVIGATION IN THE GPS ERA 

Current plans call for two of the three MAGR/S receivers 
to be powered off for most of the orbit period. MAGR/S 
state vectors will periodically be taken into the PASS 
flight software to maintain the on-board navigation state 
accuracy at an acceptable level. Ground and TDRS 
tracking will remain the primary source of state vectors 
for maneuver planning in Mission Control, until the GPS 
Ground Filter is certified. 

There is no provision for GPS attitude determination in 
the MAGR/S. Star sightings will still be used for precise 
HAINS IMU alignment. 


PRE GPS RENDEZVOUS 

Successful rendezvous requires an accurate relative state. 
Relative velocity errors, in particular, are critical. 
However, ground tracking of the orbiter and the target 
spacecraft is not accurate enough to guarantee a safe 
rendezvous within the orbiter’s tight propellant budget. 
An on-board navigation system that provides an accurate 
relative state is required. 

Shuttle rendezvous is divided into two phases, ground 
targeted and on-board targeted. For the ground-targeted 
phase, the orbiter navigation state is determined by 
ground based radar and TDRS tracking as described 
previously. Bums to be executed by the orbiter are 
computed by Mission Control (hence the term “ground 
targeted”) and uplinked to the vehicle for execution by 
the crew. The last ground targeted bum is performed on 
the day of rendezvous, 40 nautical miles behind the 
target, at about orbital noon. During the on-board 
targeted phase (Figure 2), relative sensor measurements 
are processed in a Kalman filter in the PASS flight 
software [19]. The PASS software maintains an estimate 
of the target spacecraft state (initially provided by 
Mission Control) and the filtered orbiter state. These 
states are used to compute burn solutions using an 
onboard Lambert targeting algorithm [20]. 

The star trackers used for IMU alignments are also used 
to process angular measurements of the orb iter/target 
relative state. This permits resolution of navigation errors 
normal to the star tracker line of sight. The star tracker 
pass begins shortly after the last ground-targeted 
maneuver, and will resolve most altitude and out-of-plane 
position errors. Due to change in relative geometry, some 
down-track position error will be resolved at the end of 
the star tracker pass. The end of the pass roughly 
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1 . NC. last ground 
targeted burn. 

2. Start star tracker. 

3. End star tracker. 

4. NCC, first on-board 
targeted burn. 

5. Start Radar. 

6. Ti Burn 

7. Start star tracker 
(for radar fail). 

8. MC-1 Burn 

9. Sunset. 

10. End star tracker 
for radar fail. 

11. MC-2 Burn. 

12. Sunrise 

13. MC-3 Burn 

14. MC-4 Burn 

15. Manual piloting 
phase using radar, 
TCS & HHL. 


Axes are in kilo-feet. 

NCC - Corrective Combination 
Ti - Transition Initiation 
MC - Midcourse Correction 


Figure 2: Day of rendezvous profile with burns and navigation activities indicated. Relative coordinate frame 
centered on the target spacecraft. “Vbar" is in the direction of target motion, “Rbar” is in the direction of the 
center of the Earth. 


coincides with orbital sunset, and is followed by the first 
on-board targeted maneuver. 

Incorporation of Ku Band radar measurements begins at a 
range of 135,000 feet. Range, range rate and angular data 
are obtained from this point until a range of about 100 
feet. Five more on-board targeted burns are executed to 
control the orbiter’s approach to the target spacecraft. 

At a range of approximately 8 nautical miles, there is 
another opportunity for a daylight star tracker pass, in the 
event of a radar failure. Due to the size and brightness of 
the ISS, star tracking during orbital daylight may not be 
possible for this pass. A tracking light will be on the ISS 
to facilitate processing of star tracker data at night. The 
ISS will maneuver to a night star tracker attitude at a 
predetermined time during the rendezvous. Such a failure 
occurred on STS-92 (October 2000), forcing execution of 
an “angles only” rendezvous. The rendezvous and 
docking was successful, but with slightly higher 
propellant consumption. 


After the final on-board targeted burn, at a range of about 
2,000 feet, the manual piloting phase begins. Radar data 
continues to be incorporated into the orbiter navigation 
state during the manual phase, but the primary source of 
relative navigation data for piloting comes from the TCS. 
TCS is a laser system mounted in the payload bay that 
provides relative range, range rate and angular 
information. TCS requires retro-reflectors on the target 
vehicle. Two HHL range finders are also carried. Both 
TCS and HHL can lock on to the target as far out as 5,000 
feet. 

A Kalman filter is used in the primary and backup laptop 
computers to process TCS measurements. HHL 
measurements are processed in the primary laptop, in a 
different Kalman filter than TCS. Television cameras in 
the payload bay, with ranging ruler overlays on the 
monitors, are used by the crew as an additional range 
information source from 15 feet to docking. Ku Band 
radar, TCS and HHL are also used during undocking and 
fly-around, when the orbiter leaves the ISS. 


If both the radar and star trackers are failed, the Crew 
Optical Alignment Sight may be used manually by the 
crew to obtain relative angular measurements. COAS 
measurements have never been taken in flight due to a 
sensor failure. However, after the undocking from Mir on 
STS-71, COAS data was processed as a test. 


SHUTTLE RENDEZVOUS IN THE GPS ERA 

Even if both spacecraft have GPS units, simple 
subtraction of state vectors does not provide an accurate 
enough relative state for use in burn computation. Use of 
such data could easily result in an unsafe trajectory and an 
undesirable level of propellant consumption. 
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Development of the on-board rendezvous navigation 
system for Apollo [20] (on which the Shuttle system was 
based) proved that rendezvous could be accomplished 
with high inertial state errors on both vehicles, but low 
relative state errors [21]. High accuracy inertial states on 
both spacecraft are not enough to permit accurate 
rendezvous navigation. 

If GPS relative navigation were to be used for spacecraft 
rendezvous, identical GPS receivers on the target and 
chaser vehicles are required. Processing of common 
satellite measurements from both vehicles in one Kalman 
filter permits the cancellation of common errors and 
biases (such as ionospheric error and Selective 
Availability) [22]. This in turn drives the need for a radio 
data link between the vehicles. 

The Space Shuttle program must preserve the capability 
to rendezvous with spacecraft that are not equipped with 
GPS units. The current suite of on board, relative 
navigation sensors (radar, star trackers, lasers) provide 
relative states that are just as good as or better than the 
level of accuracy possible with relative GPS. During the 
manual piloting phase and docking, there are concerns 
about GPS satellite visibility and multi-path. The Shuttle 
program currently has no plans to use relative GPS for 
rendezvous. 

PRE GPS DEORBIT 

Currently, a state vector uplink is performed prior to the 
deorbit burn to both the PASS and BFS flight software. 
This uplink is based on Mission Control processing of 
ground radar C Band and TDRS S Band data. 

DEORBIT IN THE GPS ERA 

The current operations concept calls for the three 
MAGR/S units to be operating 6 hours prior to the deorbit 
burn. Selected MAGR/S data will be incorporated into 
the Shuttle navigation software prior to the bum, 
replacing the uplink from Mission Control. As with 
ascent and orbit insertion, MAGR/S data will not be 
incorporated into navigation during powered flight. 

PRE GPS ENTRY NAVIGATION 

For most of entry, three independent navigation states are 
maintained in the PASS [23]. Each uses accumulated, 
sensed velocity data from a different IMU to protect 
against IMU failures. A selection filter selects one 
navigation state (position and velocity) for use in the 


Kalman filter. It is also passed on to guidance, flight 
control and crew display functions. 

The first navigation filter measurement to be processed is 
called "drag altitude.” Measurement incorporation begins 
when the IMU sensed deceleration is greater than 1 1 
ft/sec 2 (Figure 3). Accumulated sensed delta velocity 
data from the IMUs are used to estimate atmospheric 
density. A math model of the atmosphere then provides a 
rough estimate of altitude. Drag altitude measurements 
are rather inaccurate, but are intended to bound error 
growth in the event of other navigation system failures 

Kalman filter processing of selected TACAN range and 
bearing measurements begins at a range no greater than 
400 nautical miles from the runway and an altitude of 
roughly 140,000 feet (for a nominal entry and landing). 
TACAN bearing is not processed when the elevation 
angle of the slant range is 35 degrees or greater (cone of 
confusion). 

Significant navigation errors during entry can exceed the 
ability of the guidance and flight control system to fly the 
orbiter to the landing site. A set of limits, called guidance 
constraints, defines the maximum allowable state error. 

In the event of a navigation error that exceeds the 
constraints, a correction to the state vector can be 
uplinked directly to the PASS and BFS flight software or 
voiced to the crew for manual entry. The “delta state 
update,” which is based on radar tracking data, has never 
been executed in flight. 

Barometric altimeter measurements are processed to 
control navigation errors in the vertical channel. Two 
barometric altimeter probes are deployed at Mach 5, and 
data becomes available for Mission Control evaluation at 
Mach 3.5. Each probe provides two independent 
measurements. Kalman filter processing begins at Mach 
2.5 and an altitude of about 85,000 feet. Drag altitude 
processing ends once barometric altimeter processing 
begins. Barometric altimeter processing is inhibited 
between Mach 1.6 and Mach 1.1 (the Mach jump region). 

PASS Kalman filter processing of MLS range, azimuth 
and elevation data usually begins at about 17,000 feet. 
Once MLS is acquired, PASS stops processing TACAN 
and barometric altimeter data and shifts from maintaining 
three state vectors to one state vector. For a landing site 
not equipped with MLS, PASS processing of TACAN 
stops at an altitude of 1,500 feet, and baro processing 
continues until 500 feet. BFS does not process MLS, and 
will process TACAN and baro data all the way to landing. 
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Figure 3: Availability of navigation sensors and systems during entry. BFS does not process MLS, but processes TACAN 
and Baro all the way to landing. Radar altimeter data is for crew situional awareness only. Ground tracking data is used 
by Mission Control for independent assessment of onboard navigation systems. 


Selected radar altimeter data is available to the crew for 
situational awareness from 5,000 feet until landing. It is 
not processed in a Kalman filter, due to a lack of accurate 
terrain models for Shuttle landing sites. 

EMERGENCY USE OF “UNCERTIFIED,” SINGLE 
STRING GPS DURING ENTRY 

During the flight test phase (prior to certification, only 
one MAGR/S on each orbiter), flight rules were 
developed permitting use of selected MAGR/S state 
vectors under the following emergency conditions: 

• Use in place of a voice delta state uplink during 
entry. Complexity of the voice delta state uplink 
makes it more risky than incorporating 
uncertified GPS data. 

• Avoid scenarios (low ceilings at landing, on- 
board and/or ground station TACAN and MLS 
failures) that could result in a high risk crew 
bailout and loss of vehicle. 

• Enable Mission Control to resolve dilemmas 
between redundant navigation sensors (HAINS 
IMUs, barometric altimeters, TACANs, MLSs). 
This does not require incorporating GPS states 
into the Shuttle navigation software. 


ENTRY NAVIGATION IN THE GPS ERA 

For the first several operational flights, selected MAGR/S 
data will not be taken into the Shuttle navigation software 
between the deorbit burn and the acquisition of ground 
radar tracking (around 140,000 feet, the TACAN 
acquisition altitude). This will permit a comparison of 
MAGR/S data with ground tracking before incorporation. 
Once operational experience with the three string system 
has been obtained, navigation system updates with GPS 
will resume after the deorbit bum and continue through 
MLS acquisition (or landing if MLS is not available). 
However, selected MAGR/S states do not have to be 
continuously incorporated into Shuttle navigation to 
support entry and landing. 

Drag altitude measurements will still be processed to 
bound error growth in the event of GPS outages or IMU 
failures. It is expected that drag measurements will have 
little impact on the navigation state when GPS is 
incorporated in the automatic mode. 

Space Shuttle navigation software will continue to 
process barometric altimeter and MLS data (in the PASS) 
after TACAN has been replaced by GPS. Whenever 
selected barometric altimeter measurements are available 
for processing by the PASS and BFS GPCs, they will also 
be processed by the MAGR/S Kalman filter. This allows 
the GPS units to determine the bias on the barometric 


measurements during four satellite tracking. In the event 
of less than four satellite tracking, calibrated barometric 
altimeter measurements will help maintain accurate 
MAGR/S states. 

GPS states will be an important source of data for 
Mission Control during emergency landings at sites where 
there is no ground radar tracking capability. 

During entry, Mission Control in Houston will have an 
open line to the GPS Master Control Station (MCS) at 
Schriever Air Force Base, Colorado. Mission Control 
will be informed of any GPS satellite integrity issues that 
arise. The crew has the ability to command the MAGR/S 
units not to track specified GPS satellites for 
measurements. 


“SINGLE STRING” GPS USE AFTER 
CERTIFICATION,. 

After GPS certification, some orbiters in the fleet will 
continue to fly with three TACAN units and one 
MAGR/S, until they receive two more MAGR/S units 
during regularly scheduled overhauls. Post certification, 
single string use of GPS during entry has been proposed 
as follows: 

• Those scenarios listed under emergency use of 
uncertified, single string GPS. 

• Use as an extra level of redundancy in case of 
navigation sensor (TACAN, Air Data Probe, 
MLS) and/or ground station failures (TACAN, 
MLS). 

• Provide redundancy in the event of ground radar 
tracking station failures. 

• Avoid early mission termination due to TACAN 
failures while on-orbit. 

• Source of vectors to support emergency deorbit. 

• On-board navigation updates on-orbit, when not 
performing translational maneuvers or 
rendezvous. 

• Permit a launch in the event of a navigation aid 
(TACAN, barometric altimeter, MLS) failure on 
the pad. 


DIFFERENTIAL GPS 

Although the MAGR/S does have a differential GPS 
capability, there are currently no plans to replace MLS 
with differential GPS. Antennas and cables would have 
to be added to the Shuttle orbiters to enable reception of 
differential GPS corrections. There are technical issues 
with placing omni-directional VHF antennas under the 
thermal protection tiles in spots formerly occupied by Ku 
Band MLS antennas. Drilling more holes in the vehicle 
for antenna placement is not desirable. Studies have 
shown that differential GPS would provide little accuracy 
improvement over the current MLS system. 

SPACE INTEGRATED GPS/INS (SIGI) 

As GPS receivers became smaller, navigation system 
developers began envisioning the placement of GPS 
receivers directly inside INS boxes (an “EGI”). This 
provides cost, size and weight savings. Since GPS data 
would not have to be sent “outside” a box to be 
processed, a central Kalman filter could incorporate GPS 
measurements corrected for S/A effects, as well as other 
measurements (barometric altimeter, Doppler radar, radar 
altimeter). 

The “tightly coupled” integration scheme overcomes data 
latency issues with previous architectures. Less latency in 
aiding permits the carrier loops to be aided and speeds up 
satellite acquisition. The incorporation of all sensor 
measurements in one filter with high integration rates 
provides a much more accurate solution than “separate 
box” architectures. In addition, ground and flight testing 
has shown that the tightly coupled EGI “blended 
solution” has far superior performance under less than 4 
satellite tracking conditions than a stand alone GPS 
receiver [8]. Since an aircraft or missile is subjected to 
continuous specific force (due to thrust, lift and drag), the 
Kalman filter can obtain estimates of sensor errors as 
maneuvering makes sensor errors visible to the filter 
through position and velocity errors. Continuous 
calibration of the inertial sensors permits an accurate 
position, velocity and attitude solution during GPS 
outages (such as jamming). This also allows 
manufacturers to use lower cost inertial sensors. The 
Kalman filter also permits alignment of inertial sensors 
much faster than INS systems without GPS [24]. 

Three test flights of EGIs were conducted to determine if 
such a device could be used in space with a minimum 
number of firmware modifications. The first EGI unit to 
fly was the Litton LN-100G, with a Collins GEM III five 
channel SEM-E form factor GPS receiver. The GEM III 
contained firmware modified for space use, based on 
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GEM III Link 010, produced by Collins to support the 
Army Tactical Missile System program. The Litton EGI 
Hew on missions STS-81 and STS-86 to provide data 
gathering for NASA’s X-33 and X-34 programs. A 
Honeywell H-764G EGI, with the same type of GEM III 
receiver as was flown in the Litton unit, flew on STS-84. 

In September of 1996, Honeywell was awarded a contract 
by NASA for the Space Integrated GPS/INS, or SIG I . 
SIGI is a common NASA navigator, based on the H-764G 
EGI, to be used by both manned and unmanned space 
vehicles [25]. The Shuttle version of SIGI, intended to 
replace the MAGR/S and the HAINS IMU, contained the 
same Collins GEM III GPS receiver that was previously 
mentioned. 

Whereas the MAGR/S was integrated into the Shuttle 
avionics system as a “navigation system,” the Shuttle 
SIGI was to be'integrated as both a sensor and a 
navigator. The SIGf-blended state vector solution was 
processed by the Shuttle PASS and BFS flight software 
using the same software used to process MAGR/S data. 
GPS receiver data and control commands were kept the 
same as MAGR/S. This integration concept was known 
as “MAGR/S transparency,” and minimized the amount 
of changes to the Shuttle flight software. 

The Shuttle flight software requires a source of IMU data 
(integrated attitude rates, change in accumulated sensed 
velocity). These parameters were taken from the inertial 
sensors of the SIGI, which are treated as a sensor. The 
original inertial sensor integration concept was “HAINS 
IMU transparency,” an attempt to avoid changes to the 
Shuttle flight software. The SIGI strapdown inertial 
instrument data was to be processed within the SIGI to 
look like stable member HAINS IMU data, before being 
passed to the PASS and BFS GPCs. However, the 
transparency option would have made it impossible for 
Mission Control to identify and take action on suspect 
gyros and accelerometers. As a result, the HAINS IMU 
transparency option was abandoned. More changes were 
made to the SIGI firmware to support the Shuttle 
missionization than were expected. 

The stable members of the three HAINS IMUs are 
skewed with respect to each other, so that Mission 
Control personnel can identify suspect gyros and 
accelerometers if only two HAINS IMUs are operating. 
With the strapdown configuration of the SIGIs, the axes 
of the inertial instruments in all three SIGI units would be 
parallel, making it difficult for Mission Control to 
identify suspect inertial sensors if only two SIGIs were 
operating. As a result, plans were made to carry four 
SIGIs on the orbiters, rather than three. The SIGI DTO 
flew on Shuttle missions 86, 89, 91, 95, 88, 96 and 103. 


A laptop computer was used by the crew to operate the 
SIGI and record data. Changes were made to SIGI 
firmware based on flight test results. 

In order to get into a precise orbit the IMUs must be 
accurately aligned. Stable member HAINS IMUs are 
aligned by using the sensed Earth rotation and gravity 
direction. The platform is oriented in various directions so 
that each of the accelerometers can calibrate against the 
gravity vector and the gyros can calibrate against Earth 
rotation. With all of the advantages of a space 
missionized EGI, preflight strapdown system alignment 
presents a challenge. There are three opportunities at the 
Kennedy Space Center to make observations when the 
vehicle is at different orientations: the Orbiter Processing 
Facility, the Vehicle Assembly Building, and the launch 
pad. The difference in orientation at the three locations is 
not adequate to get a good separation of the alignment 
variables. During frequent flights of military aircraft the 
maneuvering, continuous specific force (engine thrust, lift 
and drag) and processing of GPS measurements permits 
the EGI Kalman filter to accurately calibrate the gyros 
and accelerometers. For the Shuttle, however, the short 
periods of specific force and maneuvering (ascent and 
entry) coupled with the long time periods between flights 
(months) makes the reliability of Kalman filter inertial 
sensor error estimates questionable. 

Since the HAINS IMUs are projected to be operational 
through 2010, replacement of the HAINS IMUs and 
MAGR/S units by SIGIs has been deferred. Laboratory 
evaluation of the Shuttle SIGI unit is continuing, along 
with the GPC flight software modified to support it. 

LESSONS LEARNED FROM THE MAGR/S AND 
SIGI TEST FLIGHTS 

Over the last 40 years, the U.S. manned space program 
has had a long and successful history of incorporating 
“off the shelf’ hardware into spacecraft and ground 
support systems. Both navigation upgrade projects used 
COTS products that met the requirements of the original 
customers. It was assumed that off the shelf military units 
with proven design and performance would significantly 
reduce acquisition costs, and require minimal adaptation 
for the Shuttle and minimal testing. The ground and 
flight test philosophy was that the units “worked” until 
proven to be broken. 

However, the time and effort need to test, resolve 
firmware issues and certify the MAGR/S for TACAN 
replacement exceeded initial projections. A number of 
important lessons were learned, which are detailed below: 
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Military and civilian GPS units undergo a less rigorous 
firmware requirements definition, firmware design, 
development and testing process than those used in the 
Shuttle program [26]. Furthermore, development of 
terrestrial, “non-safety of flight” navigation units entail 
less detailed analysis of flight data than the Shuttle 
program. The Shuttle program also processes avionics 
units in a more thorough and disciplined manner than 
terrestrial users. This includes strict adherence to work 
instructions, maintenance of a parts history, thoroughly 
documented investigation of problems and their 
resolution, and more rigorous test requirements. 

It is difficult to leverage off of another program’s 
firmware verification efforts. Firmware development 
schedules driven by “time to market” pressures and a 
desire to lower overhead costs (a small group of 
programmers, short development and test cycles) result in 
a higher probability of code with bugs. Some firmware 
issues resulted from .the use of terrestrial GPS receiver 
algorithms at orbital altitude. Flowever, many of the 
firmware issues that surfaced during the MAGR/S and 
SIGI flight tests were due to basic computer science 
issues, as opposed to problems arising from use of a 
terrestrial box in an environment for which it was not 
designed (space). Firmware issues that don’t manifest in 
terrestrial applications due to a flight time of minutes or 
hours can manifest during a much longer space flight. 
Shuttle program ground and flight testing of GPS 
receivers has uncovered many firmware issues that will 
aid the maintenance and development of terrestrial GPS 
receivers. Deep integration of systems makes them more 
vulnerable to software issues. As navigation systems 
become more complex and more deeply integrated, 
software quality and verification becomes more 
important. The test approach must prove that the box will 
meet requirements, rather than having to prove that the 
box is broken. 

Some firmware modifications made to the MAGR/S 
during the flight test program were the result of issues 
discovered by military users. The information that was 
found to be the most useful was from the vendor, after an 
investigation of anomalous behavior was complete. 
Reports of problems from military users received by the 
Shuttle program were difficult to judge in terms of 
potential impact to the Shuttle application. User reports 
tended to be anecdotal in nature, with little or no 
supporting data. Field reports of receiver problems could 
be traced to a variety of causes: user errors, lab set up 
errors, receiver hardware or firmware issues, radio 
frequency interference, an antenna problem, or a GPS 
satellite problem [27]. 


The trend to use Non-Developmental Item (NDI) avionics 
containing proprietary software may prevent independent 
validation and verification of firmware. The NASA 
Independent Verification And Validation (IV&V) 
contractor played a significant and valuable role in the 
MAGR/S project, as detailed in [28]. 

Both the MAGR/S and SIGI projects demonstrated the 
need for a close working relationship between users and 
vendors. The navigation vendor needs to be involved in 
early decisions on architecture and integration. Frequent 
and open communication between technical personnel 
should be encouraged. This lesson is best summed up as 
“communicate early, communicate often.” Outside 
consultants, who do not have a vested interest in the 
choice of a particular unit, should be used. Such 
consultants have “hands on experience” with COTS boxes 
and can be an important information source concerning 
their design, integration and use. 

The Shuttle MAGR/S and SIGI projects reaffirmed the 
need for rigorous and thorough flight and ground testing. 
When planning a COTS product missionization and 
integration, adequate time and personnel must be set aside 
to analyze flight and ground test data. If data is not 
thoroughly analyzed in a timely manner, firmware issues 
will go unnoticed. Performance issues arising late in the 
development and certification cycle can negatively impact 
cost and schedule. 

COTS projects often do not take into account the 
complexity of software. Most of the focus in costing 
COTS projects has traditionally been on hardware. It is 
easier to “missionize” the hardware of a COTS product 
than the firmware. Experience has shown that firmware 
modifications will often result in more delays and cost 
increases than hardware missionization. The one 
exception to this is radiation hardening of electronics for 
the space environment [29]. 

For a flight critical application (i.e. the box is required to 
safely conclude the mission), a COTS box will undergo 
more modification than in other applications. The user 
will also require more detailed knowledge of navigation 
unit design and operation than users of non-flight critical 
COTS boxes. The Shuttle program considers a box to be 
failed more quickly than a terrestrial user. Engineering 
and Mission Control personnel must have a thorough 
understanding of receiver operation and data. For 
manned space flight, lack of design insight is a safety 
issue. The assumption that state replacement (treating 
GPS as a navigation system, rather than a sensor) 
eliminated the need for detailed knowledge of the GPS 
receiver firmware was found to be false. 
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Lessons learned from using COTS software for space 
applications can also be found in references [30] (Ariane 
5), [31] (Lewis spacecraft) and [32] (Multi-Service 
Launch System). 

Perhaps the most important lesson is that modifying a 
terrestrial navigation unit for use on a spacecraft should 
be treated as a research and development project. 
Although GPS shows great promise for improving Earth 
orbit navigation, the assumption that GPS technology has 
reached maturity in “all applications” is a common 
misconception [33, 34]. 

SUMMARY 

Integration of COTS navigation units into the Shuttle 
avionics system was performed in a manner that 
attempted to minimize cost, schedule, and modifications 
to a certified, flight proven navigation system. Proven 
terrestrial navigation units that were in mass production 
were selected. The state replacement architecture, which 
treats the GPS receivers as navigation systems, permitted 
the flight test of GPS receivers and Shuttle flight software 
without introducing GPS states into baseline entry and 
orbit navigation. GPS will provide a more accurate 
navigation solution than TACAN. Cost and navigation 
performance considerations have led the Shuttle program 
to retain other entry and rendezvous navigation sensors. 

It is expected that GPS will result in a reduction of Shuttle 
ground tracking, but it will remain as a backup to GPS. A 
Mission Control based GPS Ground Filter, which filters 
GPS position and velocity to make up for the lack of 
space dynamics missionization in the MAGR/S, will 
provide accurate states for on-orbit maneuver planning. 
The Shuttle GPS capability will enhance safety during 
emergency landings at locations where ground radar 
tracking is not available. The first “three string” GPS, no 
TACAN flight will occur no earlier than 2003. Eventual 
replacement of the HAINS IMU and MAGR/S units with 
an EGI has been deferred. 

It was prudent for the Shuttle program to take advantage 
of existing, in production technology for navigation 
system upgrades. However, changes to both the 
MAGR/S firmware and Shuttle flight software were more 
extensive than anticipated. Modification of aircraft 
navigation units for space flight should be considered a 
research and development project, rather than a simple 
modification of an “off the shelf’ box. As digital 
computers have proliferated and become more complex, 
the difficulty of integrating “off the shelf’ units has 
increased. It is not safe to assume that COTS avionics are 
simple and inexpensive to integrate just because 
thousands of units have been built. This is particularly 


true for critical, “safety of flight” applications such as the 
Space Shuttle. Independent verification and validation of 
firmware is critical, and played an important role in the 
Shuttle GPS project. The difference in verification and 
certification requirements between terrestrial navigation 
users and the Shuttle program makes it difficult to 
leverage off of firmware verification efforts of other 
programs. There is a need for frequent and open 
communication between participants, at both the 
management and technical levels, throughout a COTS 
device missionization and test program. Use of COTS 
avionics in mission critical, safety of flight applications 
that differ from the original mission for which the unit 
was designed require more modification and design 
insight than is often anticipated. 
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Redundancy Emphasized In Shuttle Design 

• During ascent/entry, 4 primary computers and one backup. 
Primaries and backup run different software. 

• Pre-GPS Ascent/Entry navigation sensors: 

Ascent 
-Three IMUs 

- Ground C & S Band Radar 

Entry And Landing 
-Three IMUs 

- Three TACANs 

- Four Barometric Altimeters 

- Three MLS Units 

- Two Radar Altimeters 



- Ground C & S Band Radar 

- At least two TACAN ground 
stations. 

- At least two MLS ground 
stations. 
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Navigation Sensors For Orbit, Rendezvous & Docking 

- Three IMUs 

i 

- Two Star Trackers 

- One Ku Band Rendezvous Radar 

- One Crew Optical Alignment Sight (COAS) 

- Trajectory Control Sensor (TCS, a laser) 

- Two Hand Held Lasers (HHL) 

- Two Payload Bay Television Cameras 
With Ranging Ruler Overlays 
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Redundancy Emphasized In Shuttle Design 

m e nu' l l vrmritf IIII II IIT" , T““ I : . : 

i 

• Processing of redundant measurements from IMUs, 

TACANs, Baros and MLSs: 

- Fault Detection and Exclusion algorithms. 

- Selection filters process data from units deemed to be “good.” 

- Selected measurements are then passed to the Shuttle 
navigation software. 


• Ground radar (ascent, orbit, entry) and Tracking and Data 
Relay Satellite data (orbit) processed by Mission Control to 
independently determine Shuttle position & velocity. 
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Space Shuttle Program Is Certifying GPS To Replace TACAN 



• A keyed, 5 channel Collins Miniaturized 
Airborne GPS Receiver was chosen as a 
Commercial Off The Shelf (COTS) item. 


• “Single string” MAGR test flights began 
with STS-79 in September of 1 996. 


• Once the MAGR is certified for TACAN 
replacement, 3 MAGRs will replace 3 
TACANs on each orbiter. First flight 
without TACAN expected no earlier 
than 2003. 
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State Replacement Architecture Chosen 


• MAGR integrated as a navigation system, not as a sensor. 

• Allows data collection during flight tests from both the MAGR 
and Shuttle flight software while still using TACAN. 

• Minimized changes to the proven, navigation flight software. 

• Three configurations supported by the same version of Shuttle 
flight software: 3 TACANs and no GPS units, 3 TACANs 

and 1 GPS unit, 3 GPS units and no TACANs. 

• GPS vectors subjected to quality assurance checks & a 
selection filter. 
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GPS Not Used For Ascent 


• IMUs aligned and calibrated before liftoff, used as a source 
of accumulated sensed velocity and attitude data. 

• Navigation aids (GPS, TACAN, Baro, MLS, radar altimeter) 
that would be used for an emergency landing are powered 
on prior to launch. 

• No on-board sensor measurements are processed by a 
Kalman filter during powered flight. 

• Ground radar tracking not required by Mission Control, 
is but highly desirable. 
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Limited Use Of GPS For Orbital Operations 

• On-orbit maneuver planning currently supported by ground 
based C Band radar tracking and S Band Doppler tracking 
using the Tracking and Data Relay Satellites (TDRS). 

• MAGR firmware has not been modified to meet accuracy 
requirements to support orbit maneuver planning (TACAN 
replacement only). 

• Mission control based ground filter in development to 
process MAGR states to support maneuver planning. 

• Mission Control personnel will maintain ground radar and 
TDRS data processing skills. 
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GPS Will Not Be Used For Rendezvous 
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Most Entry Navigation Sensors Will Be Retained 
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“Easy COTS Integration” Was An Unrealistic Assumption 

..as. 

• Scope of modifications and testing required to certify MAGR 
as a TACAN replacement significantly exceeded expectations. 


♦ As digital computers have proliferated and become more 
complex, the difficulty of integrating COTS units has increased. 


• Integrators tend to focus more on hardware issues, rather than 
software. 


• For a flight critical application, high quality software is essential. 
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“Communicate Early, Communicate Often” 






wmm 




• Close relationship with the vendor is required. Vendor must 
be involved in integration architecture decision. 


• The NASA Independent Verification And Validation (IV&V) 
contractor played a significant and valuable role in the 
project. 


• In flight critical applications that differ significantly from the 
original application that a COTS product was designed for, 
design insight is essential. 


USA 
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The Most Important Lessons 


• Modifying a terrestrial navigation unit for use on a 
spacecraft should be treated as a research and 
development project. 


• Assumption that GPS technology has reached maturity 
in “all applications” is a common misconception. 
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GPS Will Enhance Shuttle Navigation 
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• Provides more accurate entry navigation than TACAN. 

• Improves safety for emergency landing sites where 
ground radar tracking is not available. 

• Near continuous availability of ground filtered GPS 
states, in conjunction with ground tracking, allows 
more responsive mission planning. 

• On-orbit, GPS is a near continuous source of state 
vectors for emergency deorbit. 
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